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Abstract 

Evidence  of  the  emerging  cyber  regime  is  mounting  every  day.  In¬ 
creasingly,  states  are  bringing  notoriously  secretive  cyber  issues  into  the 
realm  of  public  debate,  particularly  in  response  to  events  that  threaten 
the  availability,  security,  and  surety  of  cyberspace.  This  is  not  to  say  sov¬ 
ereign  states  have  taken  to  playing  international  politics  with  all  of  their 
cards  on  the  table.  States  will  continue  to  protect  sensitive  sources  and 
methods  as  they  always  have.  However,  such  evidence  does  lend  credence 
to  the  idea  that  even  powerful  states  realize  cooperation  in  cyberspace  is 
part  of  the  domain  itself.  Furthermore,  nonstate  actors’  attempts  to  in¬ 
fluence  state  policy,  atop  the  relatively  anonymous  platforms  cyberspace 
offers,  provide  even  more  reason  for  states  to  cooperate  in  their  attempts 
to  shape  and  influence  the  information  environment. 

it  jt  it  it  it 
sQC 

Three  things  came  to  mind  when  writing  “Structural  Causes  and 
Cyber  Effects:  Why  International  Order  is  Inevitable  in  Cyberspace.” 
First,  we  set  out  to  provide  an  optimistic  response  to  “cyber-pessimism.” 
Second,  we  sought  to  conceptualize  the  domain  within  the  thicker  pat¬ 
tern  of  international  politics.  And  third,  we  wanted  to  stimulate  debate 
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regarding  the  prospects  of  achieving  great-power  cooperation  in  cyber¬ 
space.  Judging  from  the  quality  of  the  responses  received,  we  seem  to 
have  been  successful  on  all  three  counts. 

When  considering  “Structural  Causes  and  Cyber  Effects,”  Christopher 
Whyte  offers  two  important  critiques  of  our  argument — both  of  which 
have  to  do  with  its  deterministic  nature.  In  the  first  instance,  no  one  can 
predict  with  Newtonian  fidelity  whether  states  will  continue  to  play  the 
determining  role  in  international  politics  that  we  ascribe  to  them.  As 
Whyte  points  out,  a  new  medievalism  may  be  on  the  horizon  whereby 
the  international  system  will  “experience  a  complexification  of  processes 
as  state  power  erodes.”  In  the  second  instance,  contemporary  notions 
regarding  the  distribution  of  power,  which  historically  favor  the  return 
of  multipolarity,  might  prove  to  be  incorrect.  Obviously,  our  theoretical 
orientation  is  not  in  line  with  such  claims,  but  that  does  not  mean  we 
hold  the  truth.  Theory  is  not  about  truth.  If  truth  is  the  question,  we  are 
in  the  realm  of  law,  not  theory.  Theories  explain  things,  and  Waltzian 
realism  still  explains  a  lot  about  a  number  of  big,  important  things.  For 
the  purposes  of  this  discussion,  however,  we  will  put  theoretical  orienta¬ 
tions  aside  and  focus  on  the  empirical  qualities  of  cyberspace  we  can  all 
agree  on:  the  world  and  its  citizenry  are  becoming  increasingly  dependent 
upon  cyberspace  and  the  strong  connections  the  domain  facilitates. 

Ordinary  social  and  political  functions  like  interstate  travel  and  market 
economies  have  been  refined  and  optimized  using  the  time  and  distance 
advantages  cyberspace  affords.  Airplanes  taking  off  from  Islamabad, 
Pakistan,  are  already  booked  fully  with  follow-on  passengers  traveling 
three  connections  and  three  countries  away.  When  a  cloud  of  volcanic 
ash  fills  the  airspace  above  Iceland,  causing  diversions  and  delays,  mas¬ 
sive  computing  power  using  cyberspace  as  its  workspace  mitigates  the 
delays  and  keeps  the  complex  scheduling  system  accommodating  such 
travel  from  crumbling.  Transnational  corporations  draw  manufacturing 
components  and  expendable  resources  from  every  corner  of  the  world 
in  finite  quantities  with  minimal  transit  times.  These  complex  arrange¬ 
ments  produce  the  goods  and  services  that  make  up  world  trade.  Cor¬ 
porate  operations  have  become  so  entrenched  in  cyberspace  that  their 
competitive  margins,  both  domestically  and  internationally,  are  depen¬ 
dent  upon  the  efficiencies  achieved  by  instantaneous  communication 
and  situational  awareness.1 


[100] 


Strategic  Studies  Quarterly  ♦  Summer  20 1 5 


Structural  Causes  and  Cyber  Effects 


What  does  this  have  to  do  with  international  order  and  cyberspace? 
Quite  simply,  as  traditional  political  and  social  functions  become  de¬ 
pendent  upon  cyberspace,  states — both  big  and  small — will  have  to  pay 
attention  to  the  domain  in  all  its  facets.  These  same  states,  as  well  as 
transnational  actors,  motivated  by  nothing  more  than  selfish  self-interest 
will  accrue  benefits  from  a  cyberspace  that  is  both  accessible  and  wide- 
reaching.  Competitive  great  powers,  like  large  firms  in  an  oligopolistic 
market — be  there  one,  two,  or  more — can  ill  afford  to  live  “off  the  grid” 
in  the  emerging  information  age;  yet  living  on  the  grid  requires  at  least 
acquiescence  to  the  structures  and  agencies  that  keep  cyberspace  alive.  This, 
coupled  with  protecting  the  enormous  capital  investments  states  and 
transnationals  have  made  in  things  like  undersea  fiber-optic  cables  and 
associated  high-tech  infrastructures  essential  for  cyberspace,  makes  the 
emergence  of  a  cyber  regime  reasonable  if  not  inevitable. 

Moreover,  as  the  world’s  information  systems  mature  and  increasing 
numbers  of  international  actors  face  the  critical  intersection  of  depen¬ 
dency  and  vulnerability,  it  is  fair  to  ask  why  cyberspace  remains  an  un¬ 
governed  frontier  today.  Quite  simply,  regimes  and  the  agreed  norms 
they  rest  on  take  time.  One  look  at  the  chronological  development 
of  early  maritime  standards  provides  a  useful  analogy.  The  sea  laws  of 
Oleron,  first  codified  in  the  middle  of  the  thirteenth  century,  for  ex¬ 
ample,  postdated  man’s  dependence  on  the  areas  beyond  the  littorals  by 
hundreds  of  years. 2  “Structural  Causes  and  Cyber  Effects”  highlights  the 
nuclear  nonproliferation  treaty  as  another  example  of  how  important, 
difficult  agreements  take  time  to  unfold.  Maturation  of  the  domain  will 
force  hard  questions  into  the  realm  of  public  debate  and  policy. 

One  important  conundrum  that  surfaces  repeatedly  throughout  the 
budding  cyber-policy  debate  is  the  ability  (or  inability)  to  attribute  cy¬ 
ber  disruptions  to  their  true  sources.  It  is  easy  for  actors  in  cyberspace 
today  to  remain  anonymous  if  they  choose  to  do  so.  Encryption  tech¬ 
nologies  allow  even  unsophisticated  actors  to  cover  their  tracks  relatively 
well.3  Nation-states  and  well-resourced  nonstate  actors  have  even  more 
advanced  capabilities  that  allow  them  to  remain  anonymous  online.4 
These  factors,  coupled  with  the  monetary  and  computing  resources  re¬ 
quired  to  record  the  actions  of  individual  people  in  cyberspace,  make 
attribution  a  difficult  task. 

States  must  attenuate  the  attribution  problem  if  they  are  to  foster 
responsible  behavior  and  accountability  in  cyberspace.  Here  again,  the 
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most  potent  long-term  solution  to  a  thorny  cyber-political  issue  rests  in 
the  need  for  cooperation.  Attribution  depends  on  evidence,  and  this  evi¬ 
dence  can  be  spread  across  information  systems  owned  by  several  sover¬ 
eign  entities — be  they  states,  commercial  companies,  or  other  politically 
motivated  groups.  Piecing  this  evidence  together  to  pinpoint  malefactors 
requires  meticulous,  coordinated  transparency  and  information-sharing 
agreements.5  While  some  evidence  can  be  gleaned  from  publically  avail¬ 
able  records  and  social  media,  states  more  often  must  work  with  one 
another  to  corroborate  information  into  actionable  intelligence.  Fur¬ 
thermore,  nonstate  actors’  attempts  to  influence  state  policy,  atop  the 
relatively  anonymous  platforms  cyberspace  offers,  provide  all  the  more 
reason  for  states  to  cooperate  in  their  attempts  to  shape  and  influence 
the  information  environment. 

Along  these  lines,  Brian  Mazanec  raises  important  questions  regard¬ 
ing  our  argument.  His  focus  on  norm  development  and  technology  is 
interesting  but,  in  fairness,  not  a  central  concern  of  ours.  As  we  put  it, 

As  the  world  transitions  from  unipolarity  to  multipolarity — as  the  structure 
of  international  politics  changes — the  collective  dependencies  upon  the  sea, 
air,  space,  and  cyber  will  intensify.  As  dependencies  intensify,  the  constraining 
effects  produced  by  multipolarity  and  oligopolistic  competition  will  be  readily 
felt  by  all.  .  .  .  In  such  a  world,  the  fortunes  and  security  of  each  will  be  tightly 
coupled  to  the  fortunes  and  security  of  the  others,  and  as  a  result,  the  great  pow¬ 
ers  will  be  incentivized  to  cooperate.6 

In  fact,  there  is  little  in  Mazanec’s  rebuttal  that  disputes  this.  In  large 
part,  this  is  because,  while  we  treat  cyberspace  as  a  domain,  he  treats 
it  as  a  weapon.  The  two  ideas  are  not  mutually  exclusive  but  do  lead 
to  different  conclusions.  Nevertheless,  even  when  one  considers  cyber¬ 
space  from  the  perspective  of  a  weapon,  his  argument  is  not  convinc¬ 
ing.  From  our  perspective,  international  agreements  regarding  nuclear, 
chemical,  and  biological  weapons  adequately  explain  why  some  states 
seek  comfort  from  vulnerability  through  policy.  Common  sense  tells 
us  that  when  a  state  determines  it  is  vulnerable  to  a  weapon  over  which 
it  holds  little  defense,  it  ought  to  strive  to  mitigate  its  vulnerabilities 
through  any  appropriate  means  necessary — policy  being  one.  Not  all 
states  are  this  shrewd,  but  most  of  them  are,  most  of  the  time.  How  else 
can  one  explain  the  longevity  of  the  Non-Proliferation  Treaty  (NPT)? 
The  NPT,  although  far  from  a  perfect  arrangement,  has  served  as  a  de¬ 
fense  for  states  too  weak  to  build  nuclear  arsenals  of  their  own;  it  has 
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lowered  the  risk  of  nuclear  proliferation  and  has  provided  some  stability 
in  a  world  of  195  states  where  each  is  responsible  for  its  own  security. 
Why  would  cyberspace  be  any  different?  Given  the  inherent  advantages 
of  offense  over  defense,  states  today  have  little  ability  to  defend  them¬ 
selves  from  attack.7  This  lends  credence  to  the  idea  that  nations  will  (or 
at  least  should)  attempt  to  limit  vulnerabilities  through  norms  and  poli¬ 
cies  where  “hard”  defenses  cannot  be  put  in  place. 

Moreover,  evidence  of  the  emerging  cyber  regime  is  mounting  every 
day.  Increasingly,  states  are  bringing  notoriously  secretive  cyber  issues 
into  the  realm  of  public  debate,  particularly  in  response  to  events  that 
threaten  the  availability,  security,  and  surety  of  cyberspace.  This  is  not  to 
say  sovereign  states  have  taken  to  playing  international  politics  with  all  of 
their  cards  on  the  table.  States  will  continue  to  protect  sensitive  sources 
and  methods  as  they  always  have.  However,  it  does  lend  credence  to  the 
idea  that  even  powerful  states  realize  cooperation  in  cyberspace  is  part 
and  parcel  of  the  domain  itself.  One  need  only  examine  recent  headlines 
to  find  such  evidence. 

The  2014  incident  in  which  hackers  compromised  information  sys¬ 
tems  at  Sony  Pictures  Entertainment  serves  to  illustrate  this  point.  Hack¬ 
ers  stole  and  damaged  hundreds  of  gigabytes  of  data,  including  future 
movie  scripts,  internal  financial  documents,  and  employee  records,  in 
response  to  Sony’s  controversial  film,  The  Interview.  The  United  States 
Federal  Bureau  of  Investigation  publically  implicated  the  North  Korean 
government  in  the  incident,  saying  “North  Korea’s  attack  on  [Sony]  reaf¬ 
firms  that  cyber  threats  pose  one  of  the  gravest  national  security  dangers 
to  the  United  States.”8  Pres.  Barack  Obama  followed  this  public  indict¬ 
ment  stating  the  United  States  would  seek  a  “proportional  response”  as 
part  of  a  campaign  to  warn  against  future  attacks.9  The  response  the  US 
government  selected  was  not  one  of  unilateral  retaliation  but  rather  was 
a  structured  call  for  coordination  and  cooperation  intended  to  fortify 
emerging  norms  of  acceptable  behavior  in  cyberspace.  Secretary  of  State 
John  Kerry  articulated  the  US  stance,  saying,  “This  provocative  and  un¬ 
precedented  attack  and  subsequent  threats  only  strengthen  our  resolve 
to  continue  to  work  with  partners  around  the  world  to  strengthen  cyber¬ 
security,  promote  norms  of  acceptable  state  behavior,  uphold  freedom 
of  expression,  and  ensure  that  the  Internet  remains  open,  interoperable, 
secure  and  reliable.”10 
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Make  no  mistake,  cooperation  and  compromise  in  cyberspace  will  not 
come  easily,  especially  between  states  with  competing  interests.  In  fact, 
the  United  States  openly  requested  assistance  from  China  in  response  to 
the  Sony  incident — only  to  be  given  the  diplomatic  brush-off.  The  New 
York  Times  quoted  one  US  official  as  saying  “What  we  are  looking  for 
is  a  blocking  action,  something  that  would  cripple  [North  Korea’s]  ef¬ 
forts  to  carry  out  attacks.”11  China  responded  by  questioning  the  United 
States’  evidence  implicating  the  North  Korean  government  in  the  first 
place.12  This  request  from  the  United  States  came  during  a  tense  lapse  in 
negotiations  between  the  United  States  and  China  over  America’s  open 
indictment  of  five  Chinese  military  hackers  for  purported  breaches  into 
US  government  and  commercial  information  systems.13  Yet,  each  retreat 
from  the  negotiating  table  thus  far  has  been  matched  by  a  subsequent 
overture  for  cooperation  from  both  sides. 

The  United  States  and  China  have  engaged  in  a  public  dialogue  regard¬ 
ing  the  future  of  cyberspace,  cyberwarfare,  intelligence,  and  intellectual 
property  since  at  least  March  2013,  when  US  National  Security  Advisor 
Tom  Donilon  overtly  connected  China  with  cyber  activities  against  US 
interests.14  This  dialogue  led  to  the  establishment  of  an  official  bilateral 
US-China  cyber  working  group  that  made  progress  toward  “interna¬ 
tional  cyberspace  rules,  and  measures  to  boost  dialogue  and  cooperation 
on  cyber  security.” 15  fiowever,  suggestions  that  both  the  United  States 
and  China  were  engaged  in  cyber  activities  that  threatened  cooperation 
seemed  to  undermine  and  complicate  these  efforts.16  Even  amid  pitted 
difficulties,  both  the  United  States  and  China  acknowledge  the  value 
of  cooperation  and  understanding  to  the  continued  potential  of  cyber¬ 
space.  As  recent  as  February  2015,  J.  Michael  Daniel,  special  assistant 
to  the  president  and  cybersecurity  coordinator  at  the  National  Security 
Council,  wrote,  “Our  Chinese  counterparts  have  told  us  that  the  United 
States  and  China  should  work  together  to  build  a  more  open,  secure,  in¬ 
teroperable  and  reliable  cyberspace.  We  couldn’t  agree  more.”17  In  short, 
China’s  recent  activities  lend  credence  to  the  idea  that  it  appears  to  be 
more  interested  in  becoming  a  “norm  maker”  than  a  “norm  breaker.” 

The  United  States  and  China  are  far  from  being  the  only  stakeholders 
in  the  cyberspace-partnership  debate.  Since  we  published  “Structural 
Causes  and  Cyber  Effects,”  six  members  of  the  Shanghai  Cooperation 
Organization  (China,  Kazakhstan,  Kyrgyzstan,  Russia,  Tajikistan,  and 
Uzbekistan)  partnered  to  present  an  updated  code  of  conduct  for  cyber- 
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space  to  the  United  Nations  (UN)  general  assembly  in  January  20 15. 18 
Additionally,  the  UN’s  International  Telecommunications  Union  has 
increasingly  focused  on  partnerships  to  extend  the  breadth  and  depth 
of  cyberspace  as  a  mainstay  of  traditional  societal  structures.  The  World 
Summit  on  the  Information  Society,  for  example,  will  gather  a  conglom¬ 
erate  of  UN  and  UN  Educational,  Scientific,  and  Cultural  Organization 
participants  in  May  2015  to  focus  on  extending  Internet  and  communi¬ 
cations  technologies  to  disadvantaged  areas  of  the  world.19  Furthermore, 
the  World  Economic  Forum  and  the  government  of  Japan  have  part¬ 
nered  to  host  a  multistakeholder  dialogue  on  cybersecurity  and  the  fu¬ 
ture  of  the  Internet  in  November  2015.  This  summit,  promising  a  cross- 
sectorial  approach  consisting  of  academic,  governmental,  and  industry 
leaders  is  focused  on  “technology,  policy-making  and  the  development 
of  cooperative  standards  and  norms.”20 

The  question  for  all  interested  parties  to  consider  is:  How  does  one 
explain  all  this  activity  in  cyberspace?  We  have  offered  a  structural  ex¬ 
planation.  That  is  to  say,  cyberspace  cannot  be  comprehended  as  a  sepa¬ 
rate  realm  of  activity  divorced  from  the  context  of  international  politics. 
Like  other  domains,  order  within  cyberspace  is  contingent  upon  inter¬ 
national  order  writ  large.  Thus,  the  great  powers  cannot  choose  to  ignore 
cyberspace  any  more  than  they  can  choose  to  ignore  the  land,  sea,  air, 
or  space.  As  the  distribution  of  power  throughout  the  world  changes, 
the  great  powers  will  strive  to  create  rules,  norms,  and  standards  of  be¬ 
havior  that  will  mitigate  the  challenges  posed  by  cyberspace — even  if 
they  might  prefer  not  to.  This  does  not  mean  they  will  be  successful  in 
their  endeavors.  It  simply  means  states,  acting  in  anarchy,  have  no  other 
promising  options.  Bffll 
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